AWS plugin MFA for source profiles

[robvadai]

Originator: #9394

Hi @maksyms ,

it works fine when I use a role but it doesn't prompt for MFA for the source profile anymore.

I added mfa_serial to my source profile.

So this source profile has mfa_serial but not role_arn and source_profile obviously.

I fixed it but the code has some duplications, need to tidy it up: https://github.com/ohmyzsh/ohmyzsh/compare/master...robvadai:bugfix/aws-mfa-with-source?expand=1

[maksyms]

@robvadai Could yo please share your anonymised .aws/config and .aws/credentials? I want to understand your setup please.

[robvadai]

~/.aws/credentials

[myprofile]
aws_access_key_id = ...
aws_secret_access_key = ...

~/.aws/config

[profile myprofile]
mfa_serial = arn:aws:iam::11111111111111:mfa/myuser
region = eu-west-1
output = json

[profile other_profile]
role_arn = arn:aws:iam::9999999999:role/user-myuser
mfa_serial = arn:aws:iam::11111111111111:mfa/myuser
source_profile = myprofile
region = eu-west-1
output = json

So my issue was when I wanted to authenticate with MFA for myprofile

[maksyms]

Ok, so you want MFA to happen when you change to both myprofile and other_profile, not only other_profile, right? If so - yes, I can see why it might not work, fair point.

[robvadai]

Yep exactly, for one company this is the set up. The other company merely uses the source profile to allow other roles' access.

[maksyms]

@robvadai understood. I've only come across "the other company" setups, hence "one company" use case wasn't catered for. I'll check your suggestions later, thanks again! 👍

[maksyms]

@robvadai I've added this feature to the plugin. I have a suspicion it will also affect #9409 .

Could you please test before I go ahead with a pull request?

The updated version of the plugin is here:

https://github.com/maksyms/oh-my-zsh/blob/mfa_for_source_profile/plugins/aws/aws.plugin.zsh

[robvadai]

MFA for 'source profile' works; what still doesn't work is here: #9409 (comment)

[robvadai]

The problem described in this issue is solved with your changes, shall we merge it to move on?